Crono

The removal test leaves a complete and saleable product standing: a 700M record contact database, waterfall enrichment, multichannel sequences across email, phone and social messaging, CRM sync and analytics, which is what the company sold before the agent layer arrived. The models sit on top as a co pilot, and the vendor's own framing says so, describing its proprietary model as learning from the user to become the perfect co pilot and branding the writing feature Rewrite with AI.

Packaging confirms it: AI writing credits are metered per tier and agents are sold as an addition to a plan rather than as the plan, so the model is a line on the bill rather than the thing being bought.

The published posture is configuration plus a stated manual option rather than an oversight architecture, which is the pattern this band was written for. Automations are described as giving full control over every action inside a sequence, tasks can be run manually or automated end to end at the operator's choice, and the Agents Hub claims every agent action is tracked and every result attributable, which is closer to an audit position than most vendors here offer.

Held at the bottom of the band because no approval gate, withholding guardrail, confidence threshold or escalation path is described anywhere, the tracking claim is asserted without a described artefact, and automate everything is offered as a supported mode on a product that sends on the operator's behalf.

The model is described as proprietary and trained on millions of data points to replicate the work of experienced sales professionals, and that is the whole of the disclosure. Provider, family, version, inference location and any third party dependency go unnamed, and a claim of proprietary training raises more questions than a named vendor would settle.

The one number published about model output quality is the enrichment accuracy figure, and it appears twice on the same platform page at two different values, 84 percent in one section and over 85 percent in another, with no sample, method or measurement date behind either.

Four named customer stories carry named outcomes: Spoki at 12 percent higher average contract value in three months, Alibaba.com at 70 percent revenue growth in a local market, Unguess at more than 800 qualified meetings, and Serenis at 19 percent more demos booked. Add 300 or more B2B companies claimed, a live G2 profile with reviews, and a Product Hunt Product of the Day badge.

Off the top of the band because no method, period or sample sits behind any of the four figures, the enrichment accuracy claim contradicts itself on a single page, and independent review sentiment on that same G2 profile records contact data accuracy as a recurring complaint, which is the one claim the vendor quantifies.

A dedicated GDPR page does something most vendors here avoid: it takes a published position on lawful basis, stating that the regulation cites direct marketing as a likely legitimate interest and that Crono believes most B2B marketing is protected on that basis if executed thoughtfully, while conceding that poorly targeted campaigns may not qualify. That is a real position and it earns the top of this band. Two things hold it there.

The same page tells the buyer that if they are emailing anyone outside the regulation's jurisdiction it does not apply, which frames a jurisdictional boundary as a permission, and no other regime is named anywhere on the surface read, on a product that sends email, social messages and calls across Europe and beyond. No product control is described that enforces any position the page takes.

Three legal documents are published and footer linked, terms, privacy policy and a dedicated GDPR page, and the GDPR page states that a data processing addendum sits inside the privacy policy and terms and that users may access or remove their data. Reading it is what holds the grade down, because the page contradicts itself on the single question that matters most for a vendor selling a contact database.

Its glossary states that Crono and Crono's customers are considered data controllers, then that Crono is also considered a data processor, and the later section states flatly that Crono operates as a data processor facilitating user communication with prospects. A vendor sourcing and supplying 700M records is a controller for that database, and the document asserts and then walks back exactly that. A data protection officer, an EU representative for a United Kingdom entity selling into the EU, and a sub processor list are all absent from the pages read.

The architecture is published and the sources are not. A waterfall queries ten or more data providers in sequence to return an email address or phone number, and 700M contacts sit behind it, with no provider named, no licence stated and no collection method described.

The finding is that the vendor writes down the obligation itself: the consent entry in its own GDPR glossary states that where contact information is obtained through a third party, the source must be specified during the initial contact with the data subject. Nothing in the product is described as surfacing that source, and no notification, self service lookup or removal route was located for the people in the database. Held at the top of the band because the waterfall structure and the provider count are disclosed at all, which is more than several data vendors here manage.

A web extension is marketed for finding leads while scrolling and for running real multichannel sequences that include social messaging, which places automated action on a professional network under the operator's own account. Custody appears to stay with the user, since the mechanism is a browser extension rather than server side sending, and the marketing carries none of the tells that take this axis lower: rotation, proxies, multi account stacking, warmup of social accounts and undetectability language are all absent.

The only acknowledgement of the platform anywhere is a footer trademark disclaimer stating no affiliation with Microsoft or LinkedIn, which is a legal shield rather than a conformance position, and no rate limit, automation policy or account risk statement was located.

The vendor's own copy raises the training question and the documentation leaves it open. The proprietary model is described as learning from the user and from high quality data, and the platform holds sequence content, reply text, CRM records and connected mailbox activity for 300 or more customers, so whether one customer's material improves a model serving another is the obvious question to answer.

A statement on training, tenancy or retention appears nowhere on the pages read, and the GDPR page's nine point compliance list describes process undertaken with legal counsel rather than any control a buyer can verify.

Manufactured effort is the product and the marketing says so plainly, promising AI that feels human and a model that rewrites messages to sound like the sender. Agents can be built for prospecting, research, outreach and follow up and assigned to workflows beside reps, so a recipient may receive a researched, personalised approach that no person composed. Article 50 goes unmentioned on a United Kingdom vendor selling into European markets.

Held at the middle of the band because messages send from the operator's own mailbox and social account under their own name, no synthetic voice or invented persona appears anywhere, and nothing in the product impersonates a named human.

The deepest integration surface graded outside the enterprise platforms. Native connections to HubSpot, Salesforce, Pipedrive, Gmail, Outlook, Aircall, Ringover, Clay and n8n among fifty or more tools, which reaches both the workflow automation and the data orchestration layers rather than just the CRMs. A public API with its own documentation site is published openly and linked from the main navigation rather than gated behind a sales conversation.

The vendor also publishes an MCP server on its own homepage, presented as letting AI agents and external tools interact directly with sales workflows, which makes it the seventh in the index and places it in the small group building for agent access rather than only for humans. Recorded as observed and not weighed against the grade: third party reporting places API access in the top published tier, which could not be verified on the vendor's pricing page this pass.

The residency question goes unanswered across every page read. Hosting provider, processing region, storage location and any sub processor list are all absent, and the GDPR page addresses cross border transfer only as a glossary definition rather than as a statement of where this vendor's data actually sits.

That gap is more consequential here than for most: the entity is a United Kingdom company selling into European markets, holding 700M contact records plus connected mailbox content, and its own published buyer guidance elsewhere on the site tells prospective purchasers to confirm in writing that no data leaves EU based servers.

The security surface is a self produced GDPR badge in the footer and a single line in the GDPR page committing to updating and maintaining data security standards and workflows. No certification is claimed, no trust centre, security page, audit, penetration test, control set or status page was located, and the access the product holds is substantial: connected mailboxes, a social selling extension acting under the operator's account, CRM write access and a 700M record database.

Held at the bottom of the band rather than lower because the vendor makes no certification claim it fails to substantiate, and because the browser extension architecture leaves credential custody with the user.

A full pricing page is published with named tiers, a feature comparison and an unusually detailed FAQ that answers the questions buyers actually hit: purchased top up credits carry no monthly expiry and are consumed until exhausted, an account may be used by one user at a time, annual licences can be transferred by the subscription administrator, and upgrades apply immediately while cancellations take effect at the end of the purchased quarter or year.

Third party reporting places the tiers at 99 euros per user per month for Pro, covering multichannel sequences, three mailboxes per user, email and phone credits, AI writing credits and CRM integration, and 149 euros for Ultra, adding lead scoring, signals, Salesforce, API access and onboarding, with a five user minimum on advanced plans and AI agents sold as an addition.

Off the top of the band because the agent add on price is not established, directory listings still carry a 39 euro entry that reconciles with neither current tier, and the mailbox counts make the real cost a function of sending volume rather than seats. The pricing page declines automated access, so the figures here come from third party reporting alongside the vendor's own published FAQ text. Re verify at crono.one/pricing.

One sentence on the GDPR page carries the whole position: the processing addendum inside the privacy policy and terms is said to grant users control over their data and the freedom to access or remove it from the system. The practical exit is better than that sentence suggests, because contacts, activity and deal progress sync continuously into the customer's own CRM by design, so a departing customer keeps most of the working record in a system they already control.

Held at the top of the band because no export mechanism is documented, no post termination retention period, deletion timeline or deletion artefact is stated, and the terms themselves went unread this pass.

Sequences send from the operator's own connected mailbox, so the reputation at risk belongs to the buyer rather than to a shared vendor pool, which is the sound half of the picture. The other half is a volume mechanism with no discipline described around it: three mailboxes per user on the mid tier and more above it, which is the multi inbox pattern that raises throughput per seat. Warmup, authentication guidance covering SPF, DKIM and DMARC, bounce or complaint thresholds, blocklist monitoring, placement testing and suppression handling are all absent from the pages read.

The market is named in the vendor's own page title, outbound sales orchestration for mid market B2B teams, and the positioning is supported rather than asserted: four role specific pages for revenue operations, sales development, sales leaders and account executives, five published comparisons against Lemlist, Outreach, Salesloft, Amplemarket and Apollo which place the product precisely in its tier, a five user minimum on advanced plans as a practical floor, and a customer base of 300 or more B2B companies with a visible concentration in Italy and the United Kingdom. Off the top of the band because no headcount band, no customer size distribution and no ceiling are published anywhere.